AIKIDO-2026-260229
apache-airflow-providers-keycloak is vulnerable to Reliance on Cookies without Validation and Integrity Checking
91
CVE Score
Critical
Reliance on Cookies without Validation and Integrity Checking
TL;DR
From Airflow 3.3, the Keycloak auth manager derives a user's identity from a cookie value without checking that Keycloak signed the cookie. A caller who can set that cookie can present an arbitrary Keycloak identity, and Airflow grants access under it. The fix validates the cookie's signature before trusting the identity it carries.
How do I fix this?
Upgrade the apache-airflow-providers-keycloak library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the Keycloak auth manager with cookies reaching Airflow from an untrusted browser context.
Versions
0.0.1 - 0.9.0
Fixed in 0.10.0Background info
apache-airflow-providers-keycloak is vulnerable to Reliance on Cookies without Validation and Integrity Checking in versions 0.0.1 - 0.9.0.
Links
Other
airflow.apache.org/docs/apache-airflow-providers-keycloak/0.10.0/changelog.htmllists.apache.org/thread/5cqh5ojl3718ogb0q1dcd9vdr47z7gp3lists.apache.org/thread/5cqh5ojl3718ogb0q1dcd9vdr47z7gp3?users@airflow.apache.orgopenwall.com/lists/oss-security/2026/09/15/8
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.